Privacy Policy

1. Who we are

Doobitech ("we", "us", "our") is a SaaS platform operated by a DED-licensed business in Dubai, United Arab Emirates. We provide WhatsApp-based order management software for laundry and dry-cleaning businesses.

Contact: support@doobitech.com

Who is responsible for whose data

This distinction decides who you should contact, so it is worth stating plainly.

• For shop owners — Doobitech is the controller. We decide what account, billing and verification data we hold about the businesses that subscribe to us, and this policy governs it.
• For laundry customers — the laundry shop is the controller and Doobitech is its processor. When you message a shop’s WhatsApp number, you are dealing with that shop. It decides why your data is collected and how long it keeps it; we only run the software that carries the order, and we act on that shop’s instructions.

If you are a laundry customer and you want your data corrected or deleted, ask the shop you ordered from. You may also write to us at the address above and we will pass the request to them and support it.

2. What data we collect

From Shop Owners (B2B customers)

• Name, email address, password (hashed)
• Shop name, WhatsApp business number
• Trade licence number and, where you send one to us during onboarding, a copy of the licence document
• IP address at time of Terms acceptance
• Billing information (processed by Stripe — we do not store card numbers)

From End Customers (laundry customers)

• WhatsApp phone number
• Name (if provided)
• Pickup address and GPS coordinates
• Order history and services selected
• Preferred language
• Star ratings and comments (if submitted)

Automatically collected

• WhatsApp message logs (sent and received)
• Session data in Redis (30-minute TTL, auto-deleted)
• Usage logs and error reports

3. How we use your data

• To provide and operate the Doobitech platform
• To process orders and send WhatsApp notifications
• To verify trade licenses and maintain compliance
• To process subscription payments via Stripe
• To send service announcements and billing alerts
• To improve platform performance and fix errors
• To comply with UAE legal obligations

We do not sell, rent, or share personal data with third parties for marketing purposes.

4. Legal basis for processing

Under UAE PDPL, we process personal data on the following bases:

• Contract performance — processing necessary to provide the subscription service
• Legal obligation — trade license verification, VAT records, PDPL compliance
• Legitimate interest — platform security, fraud prevention, error monitoring
• Consent — marketing communications (opt-in only)

5. Data storage and security

5.1 Orders, customers and account records are stored in a Supabase PostgreSQL database hosted in EU West 2 (London, United Kingdom). Short-lived conversation state is held in an Upstash Redis cache and expires automatically after 30 minutes.

5.2 All data is encrypted in transit (TLS 1.2+) and at rest.

5.3 Shop owner passwords are hashed by Supabase Auth using bcrypt. The internal administration passkey is hashed using scrypt. Neither is stored in plain text, and neither is recoverable by us.

5.4 Access to production data is restricted to authorised Doobitech personnel only.

5.5 Every request to the platform is authenticated and scoped to a single shop before any record is read or written, so one shop’s orders, services, settings, staff and message history are not reachable from another shop’s account. Row-Level Security is additionally enabled on the database as a second layer.

5.6 We do not claim that our systems are immune to compromise. Section 9 sets out what we do if one occurs.

6. Data retention

7. Third-party services

Transfers outside the UAE

Doobitech is operated from Dubai, but the services above host and process data outside the United Arab Emirates — principally in the United Kingdom and the European Union, and in the United States for payment processing, email delivery and error monitoring.

Under Articles 22 and 23 of the UAE PDPL, personal data may be transferred outside the UAE where the receiving country provides an adequate level of protection, or where appropriate contractual safeguards are in place. We rely on the data processing terms and standard contractual clauses offered by each provider listed above, and we do not transfer personal data to any provider that does not offer them.

If you would like to know which providers hold data relating to you specifically, write to us and we will tell you.

8. Your rights under UAE PDPL

Under Federal Decree-Law No. 45 of 2021, you have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data
• Right to restrict processing — limit how we use your data
• Right to data portability — receive your data in a structured format
• Right to object — object to processing based on legitimate interest

To exercise any of these rights, email support@doobitech.com. We will respond within 30 days as required by UAE PDPL.

If you ordered from a laundry that uses Doobitech, that laundry is the controller of your data (see section 1), so the fastest route is usually to ask them directly. Write to us either way if you would rather, or if they do not respond.

If you are not satisfied with how we have handled your request, you have the right to complain to the UAE Data Office. Doing so does not affect any other legal remedy available to you.

9. Data breach notification

In the event of a personal data breach, Doobitech will notify the UAE Data Office and affected individuals as soon as possible and in accordance with the timelines required by UAE PDPL.

10. WhatsApp data notice

The first message a customer receives from a shop’s WhatsApp number names that shop, states that their number and order details are used to handle their order, identifies Doobitech as the software behind it, and links to this policy. It is sent before the customer has given anything beyond the phone number their message arrived from.

Message content is exchanged through the WhatsApp Business API and is also subject to WhatsApp’s own terms and privacy policy, over which we have no control.

11. Children's data

Doobitech does not knowingly collect data from individuals under the age of 18. If we become aware that we have collected data from a minor, we will delete it immediately.

12. Changes to this policy

We may update this Privacy Policy periodically. We will notify you via email and WhatsApp at least 14 days before material changes take effect. The current version and effective date are always shown at the top of this page.

13. Contact us

For any privacy-related questions, data requests, or complaints:

Email: support@doobitech.com

We aim to respond to all privacy requests within 5 business days.